CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product redhat:enterprise_linux_server_eus. Show all products

21 CVEs, showing 1 to 21

CVE	Severity	Title	Published
CVE-2021-4034 Known exploited	High 7.8	A local privilege escalation vulnerability was found on polkit's pkexec utility. Assigned by redhat	Jan 28, 2022
CVE-2019-5544 Known exploited	Critical 9.8	OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. Assigned by vmware	Dec 6, 2019
CVE-2019-3856	High 7.5	An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3857	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. Assigned by redhat	Mar 25, 2019
CVE-2019-3863	High 7.5	A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. Assigned by redhat	Mar 25, 2019
CVE-2019-9948	Critical 9.1	urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggerin… Assigned by mitre	Mar 23, 2019
CVE-2019-3855	High 7.5	An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. Assigned by redhat	Mar 21, 2019
CVE-2019-9636	Medium 5.3	Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. Assigned by mitre	Mar 8, 2019
CVE-2018-5407	Medium 4.7	Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. Assigned by certcc	Nov 15, 2018
CVE-2018-11784	Medium 4.3	When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. Assigned by apache	Oct 4, 2018
CVE-2018-14634 Known exploited	High 7.8	An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Assigned by redhat	Sep 25, 2018
CVE-2017-5436	High 8.8	An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.	Jun 11, 2018
CVE-2016-9079 Known exploited	High 7.5	A use-after-free vulnerability in SVG Animation has been discovered. Assigned by mozilla	Jun 11, 2018
CVE-2017-5645	Critical 9.8	In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,… Assigned by apache	Apr 17, 2017
CVE-2016-10165	High 7.1	The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which… Assigned by mitre	Feb 3, 2017
CVE-2016-5388	High 8.1	Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted cli… Assigned by redhat	Jul 19, 2016
CVE-2016-3427 Known exploited	Critical 9.8	Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vector… Assigned by oracle	Apr 21, 2016
CVE-2015-5123 Known exploited	High 7.8	Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows a… Assigned by adobe	Jul 14, 2015
CVE-2015-5122 Known exploited	High 7.8	Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Window… Assigned by adobe	Jul 14, 2015
CVE-2014-0196 Known exploited	Medium 5.5	The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial… Assigned by redhat	May 7, 2014
CVE-2014-0160 Known exploited	High 7.5	The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process… Assigned by redhat	Apr 7, 2014

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.